DPDP Compliance for OTT and Streaming Platforms: Viewing Data and Profiling

Every title watched, paused, rewatched, or abandoned midway feeds a recommendation engine that shapes what a user sees next, and that profiling is a purpose distinct from simply providing the streaming service itself. The notice a subscriber sees at sign-up should say plainly that viewing behaviour drives personalised recommendations, and ideally offer a way to see or reset that profile, consistent with the spirit of the access right under Section 11 even where the platform is not compelled to build a granular dashboard for every data point.

Genre and content preferences inferred from viewing history can reveal fairly personal information — health conditions, sexual orientation, political leanings — through the content someone chooses to watch, even without the platform ever asking about those things directly. That inferential sensitivity is worth factoring into how tightly recommendation data is guarded internally, even though the Act does not create a separate sensitive-data category.

Shared family subscriptions commonly include a dedicated kids' profile with curated content, and any behavioural tracking or targeted advertising directed at that profile runs into Section 9's restrictions on processing children's data for behavioural monitoring or targeted ads. A platform that maintains one recommendation engine across all profiles, adult and child alike, needs to make sure the child profile's viewing data is not being folded into an ad-targeting model that treats it the same as an adult profile's.

Verifying that a “kids' profile” is genuinely being used by a child, versus an adult simply selecting the kids' interface for content filtering, is an imperfect exercise, but platforms should still err toward restricting monetisation-driven profiling on profiles marked as children's rather than assuming ambiguity resolves in favour of full tracking.

A streaming platform with a large subscriber base processing viewing data continuously is a plausible candidate for government notification as a Significant Data Fiduciary under Section 10, which brings a mandatory resident Data Protection Officer, independent data audits, and periodic impact assessments. Building the recommendation and advertising data pipeline with those audits in mind from the start — clear data lineage, documented purposes — is considerably cheaper than retrofitting it once notified.

Ad-supported tiers add a further layer: advertising partners receiving viewing-segment data for targeting are effectively receiving a proxy for content preferences, and those partnerships need the same processor or joint-fiduciary contractual clarity as any other third-party data share.

The Readiness Assessment is worth running specifically to gauge exposure to Significant Data Fiduciary status given subscriber scale and profiling intensity. The Rights Navigator can also help design a subscriber-facing way to understand and reset a recommendation profile, which does double duty as a trust feature and a compliance one.